Which versions of Concrete CMS are affected by CVE-2026-8197?

Concrete CMS versions 9.5.0 and earlier contain a stored cross-site scripting vulnerability in the OAuth authorization template that allows administrators to inject malicious scripts through the…. A patch is available.

How to fix or mitigate CVE-2026-8197?

Within 24 hours: Audit all administrative accounts for unauthorized access or compromise; determine which OAuth integrations are actively used; restrict admin console access to trusted personnel only. Within 7 days: Enforce multifactor authentication (MFA) on all administrative accounts; implement IP-based access controls on the admin panel; disable all non-critical OAuth integrations. Within 30 days: Subscribe to Concrete CMS security advisories; apply vendor patch immediately upon release and availability; until patched, maintain strict admin access controls and continuous monitoring of OAuth authentication logs.

Concrete CMS CVE-2026-8197

Q: What is the CVSS score of CVE-2026-8197?

CVE-2026-8197 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31342 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 ff5b8ace-8b95-4078-9743-eac1ca5451de

GHSA-h72c-xx3w-w8h7

PHP XSS

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 21:32 vuln.today

DescriptionCVE.org

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete's t() translation helper as a sprintf-style format. The ... wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Thanks Yonatan Drori (Tenzai) for reporting.

AnalysisAI

Stored cross-site scripting in Concrete CMS 9.5.0 and earlier allows a high-privileged admin to inject arbitrary HTML/JavaScript into the OAuth authorize template via the integration name field. The flaw arises because the integration name is wrapped in tags by PHP string interpolation before being passed to the t() translation helper, causing the resulting raw HTML to be rendered when end users view the OAuth consent screen. No public exploit identified at time of analysis, but a rogue or compromised admin could potentially harvest OAuth login submissions from victims.

Technical ContextAI

Concrete CMS is an open-source PHP-based content management system. The vulnerable code path is in the OAuth authorize template, where the admin-supplied integration name is concatenated with HTML markup (...) via PHP string interpolation, and the resulting composite string is then handed to Concrete's t() localization helper which treats it as a sprintf-style format. Because the HTML wrap is constructed before translation/escaping occurs, the integration name lands in the rendered output as raw HTML rather than escaped text - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) defect rooted in incorrect ordering of escaping versus markup composition.

RemediationAI

Upgrade to Concrete CMS 9.5.1 or later, which contains the fix per the vendor's 9.5.1 release notes at https://documentation.concretecms.org/9-x/developers/introduction/version-history/951-release-notes. If immediate patching is not feasible, compensating controls include restricting admin role assignment to a minimum trusted set and reviewing any existing OAuth integrations for suspicious integration-name values containing HTML or script syntax (this trades operational friction for risk reduction in multi-admin environments). Auditing admin activity logs for unexpected OAuth integration creation or modification will help detect attempted exploitation; disabling OAuth integration management entirely is an option for sites that do not use the feature but will break any legitimate OAuth flows currently in place.